Qixiangyun Risk Report Generation

Problem

Enterprise risk reports usually involve open-platform APIs, temporary web login, one-time consent, and asynchronous task states. Asking users to paste tax IDs, phone numbers, verification codes, or API keys in chat is unsafe and breaks the workflow. This skill wraps those steps in a controlled Agent flow: users only see a login entry, consent confirmation, and report download, while the Agent handles login flow, grants, task binding, and polling.

How It Works

• Setup: It requests Qixiangyun platform credentials only when an explicit local single-user configuration contract is returned, then writes them through sensitive stdin to local .env, avoiding argv, logs, and tool output.
• Login: apply, query, and wait first create a one-time login page; after the user completes Qixiangyun web login, the workflow resumes with a short-lived Agent Grant.
• Consent: After the web session binds the target company, the Agent shows company name, report format, scope, purpose, and retention notes; submission happens only after explicit consent and a private intent parameter.
• Reporting: Supports PDF, JSON, or both; keeps taskId for later lookup; returns finished reports as a download risk report action without exposing raw URLs or internal IDs.

Boundaries

• Best for local single-user or private deployments; shared .env, multi-tenant, and centralized environments should use platform secret management.
• Expired product authorization, exhausted trial usage, or failed query authorization binding are manual-handling terminal states; the Agent should not auto-retry, relogin, or resubmit.
• Risk reports are for business reference only and do not constitute final legal or tax advice.